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Recently, Zhang, Li, and Guo have proposed a particular 
eavesdropping attack [Phys. Rev. A 63, 036301 (2001)] which 
shows that my quantum key distribution protocol based on 
entanglement swapping [Phys. Rev. A 61, 052312 (2000)] 
is insecure. However, security against this attack can be at- 
tained with a simple modification. In addition, a simpler 
version of the protocol using four qubits is introduced. 

PACS number(s): 03.67.Dd, 03.67.Hk 



The particular eavesdropping attack proposed by 
Zhang, Li, and Guo 111 shows that the protocol for quan- 
tum key distribution introduced in Ref. B is insecure. 
Here I shall describe a way to elude this eavesdropping 
attack. I shall use the same notation and scenarios as in 
Refs. [0,||. In particular, by "the Bell operator" I mean 
one that has eigenvectors |00), |01), |10), |11), as defined 
in li- 

Consider six qubits numbered 1 to 6. Alice prepares 
qubits 1 and 2 in the state |00)-^2, and qubits 3 and 5 
in the state 100)35. Bob, prepares qubits 4 and 6 in the 
state 100)45. Therefore, the initial state of the six qubits 
is 
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Alice sends qubit 2 out to Bob and Bob sends qubit 6 out 
to Alice using a public channel. Then Alice randomly 
chooses between the following two procedures: 

(i) Alice measures the Bell operator on qubits 1 and 3. 
The result of this measurement will define the key. Then 
Alice measures the Bell operator on qubits 5 and 6, and 
publicly announces this result. Then Bob measures the 
Bell operator on qubits 2 and 4. If Eve is not present, the 
result of this measurement and the public result would 
allow him to ascertain the key (see Table I) . 

(ii) Alice performs the unitary transformation 
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on qubit 3. This transformation changes the initial state 
of qubits 3 and 5, |00)3g, into the state 
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Then Alice measures the Bell operator on qubits 1 and 
3 (the result of this measurement will define the key), 
and then she measures the Bell operator on qubits 5 and 
6, and publicly announces this result. In addition, Alice 
announces that she has performed the unitary transfor- 
mation S on qubit 3. In this case. Bob performs the uni- 
tary transformation S on qubit 4, and measures the Bell 
operator on qubits 2 and 4 (again, if Eve is not present 
the result of this measurement and the public result allow 
him to ascertain the key; see Table I). 

Now we will see that Eve's attack suggested in jj does 
not work if Alice chooses procedure (ii). We shall use 
the same numbering for the qubits as in [y. Suppose 
that Alice performs the transformation S on qubit 3, and 
then measures the Bell operator on qubits 1 and 3, and 
obtains the result "00." Then, the state of qubits 2 and 
5 becomes |++)25- Suppose that when Eve measures the 
Bell operator on qubits 6 and 8, she obtains the result 
"01" (then the state of qubits 4 and 7 becomes [01)47). 
Then Eve performs the transformation Z on qubit 2, as 
suggested in p] . This transformation changes the initial 
state of qubits 2 and 5, |++)25i into the state 
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Therefore, when Alice measures the Bell operator on 
qubits 2 and 5, the probability of obtaining the result 
"00" is i, and the probability of obtaining the result 
"11" is i. Suppose Alice obtains "11." Then, she an- 
nounces this result and the fact that she has performed 
the transformation S*; i.e., that she has chosen the pro- 
cedure (ii). Then Bob performs the transformation S on 
qubit 4. This transformation changes the initial state 
of qubits 4 and 7, |01)4y, into | — h)4y. Therefore, when 
Bob measures the Bell operator on qubits 4 and 7, the 
probability of obtaining the result "00" is ^, and the 
probability of obtaining the result "11" is \. Suppose 
Bob obtains "00." Then Bob infers that, if Eve is not 
present, the key is "11." However, as we have seen, the 
key is "00." Therefore, Alice and Bob will detect Eve if 
they compare their two bits. In addition, once Eve knows 
that Alice has chosen procedure (ii), she cannot ascertain 
whether the key is "00" or "11." Table II contains all 
the possible results of Alice's, Bob's, and Eve's measure- 
ments for the two procedures for a particular value of the 
key ("00"). It shows that Eve's attack suggested in ||] 
works if Alice chooses the procedure (i), but gives only 
partial information about the key, and allows Alice and 
Bob to detect Eve in half of the runs if Alice chooses the 
procedure (ii). 



There exists an attack that allows Eve to ascertain the 
key without being detected in case Alice has chosen pro- 
cedure (ii). This attack requires a different Bell state 
measurement on qubits 6 and 8 and different unitary op- 
erations on qubit 2. However, this new attack does not 
allow Eve to obtain the key without being detected if 
Alice chooses procedure (i) . The security of the protocol 
relies on Eve necessarily deciding her attack before know- 
ing Alice's choice. Assuming that Alice randomly chooses 
between (i) and (ii), and that Eve randomly chooses be- 
tween the two different attacks mentioned above. Eve will 
be detected with a probability 1 — (|) , where n is the 
number of pairs of bits compared by Alice and Bob. Thus 
if N bits are tested, the probability of Eve's detection is 

1 — (I) . Therefore, the protocol is less efficient at de- 
tecting Eve than BB84 ^ or B92 Q. On the other hand, 
other interesting aspects of the original protocol such as 
the fact that it delivers one key bit per transmitted bit 
are retained in the new version. 

So far, I have presented a modification of the protocol 
PI that avoids the attack described in Ref. m. My aim 
has been to change the original proposal as little as pos- 
sible. A simpler protocol for quantum key distribution 
using entanglement swapping is as follows: 

(a) Alice prepares four qubits in the state 
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and sends qubits 2 and 4 to Bob through an insecure 
quantum channel. 

(b) Alice chooses between the following procedures: 
(I) doing nothing, (II) performing S on qubit 1 (which 

changes |00)^2 ™to l++)i2)- 

(c) Alice measures de Bell operator on qubits 1 and 3. 
The result of this measurement defines the key. Then she 
publicly announces the procedure she has chosen. 

(d) If Alice chose (I), then Bob would measure the 
Bell operator on qubits 2 and 4; if Alice chose (II), then 
Bob would perform S on qubit 2 (which changes |++)i2 
into 1 00) -1^2): ^ii'i would then measure the Bell operator 
on qubits 2 and 4. In both cases, the result of the Bell 
operator measurement would allow him to ascertain the 
key. 

In this four-qubit version of the protocol, for each of 
Alice's procedures. Eve can ascertain the key without 
being detected if she performs the appropriate Bell state 
measurement on qubits 2 and 4, and then gives them to 
Bob in the resulting Bell state. However, as in the six- 
qubit version, such attack would only work for one of the 
procedures, and it could be detected in half of the runs 
of the other procedure. 

Both the revised protocol and the new one are secure 
against a specific attack. It would be desirable to obtain 
rigorous proofs of security analogous to the proofs of se- 
curity of the BB84 |g|-^. Indeed, it may not be unfeasible 
to obtain such proofs as a derivation of the existing ones, 
since both the revised protocol and the new one have 



greater similarities with the BB84. 

I wish to thank Y.-S. Zhang, C.-F. Li, and G.-C. Guo 
for pointing out the insecurity of the protocol yj, for 
checking the modification presented here, and for sug- 
gesting a way to simplify it. 
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Alice 



Bob 



Procedure Key Public Secret Inferred key 

JT) 00 00 00 00 

(i) 00 01 01 00 

(i) 00 10 10 00 

(i) 00 11 11 00 

(ii) 00 00 00 00 

(ii) 00 10 01 00 

(ii) 00 01 10 00 

(ii) 00 11 11 00 



TABLE I. The columns represent, from left to right, the strategy chosen by Alice, the result of her secret measurement on 
qubits 1 and 3 (the key), the result of the public measurement on qubits 5 and 6, the result of Bob's secret measurement on 
qubits 2 and 4, the result that Bob thinks is the key, in all the cases in which the key is "00," and assuming that the initial 
state is given by Eq. (hh. 
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TABLE II. The columns represent, from left to right, the strategy chosen by Alice, the result of her secret measurement on 
qubits 1 and 3 (the key), the result of the public measurement on qubits 5 and 6 (5 and 2 in the notation of Ref. M), the result 
of Bob's secret measurement on qubits 2 and 4 (7 and 4 in the notation of Ref. ||l|), the result that Bob thinks is the key, the 
result of Eve's measurement on qubits 6 and 8 (in the notation of Ref. |lj), the corresponding unitary transformation on qubit 
2 (as described in Ref. M), the result that Eve thinks is the key, in all the cases in which the key is "00," and assuming that 
the initial state of Alice's and Bob's qubits is given by Eq. (|l|), and that the initial state of Eve's qubits is |00)^g. 



